Hub for organizations replacing or shrinking Microsoft Active Directory Domain Services with Samba AD or FreeIPA: Windows Server licensing and lifecycle, what open-source directories cover, and the comparison, migration and cost pages under it.
Windows domain controllers against Samba as an AD-compatible DC: functional level support up to 2016, Group Policy and SYSVOL replication gaps, DNS backends, Windows client compatibility, and the estates where Samba is a safe replacement and where it is not.
Active Directory against FreeIPA for Linux-heavy estates: FreeIPA is not an AD domain for Windows clients, so the real choice is replacing AD for Linux identity, Kerberos, sudo and host policies, or keeping AD and trusting it from FreeIPA.
The coexistence path Samba documents: joining Samba DCs to the existing domain, checking the functional level, transferring roles, handling SYSVOL and idmap synchronization, and retiring Windows DCs, with the checks to run before demoting the last one.
Moving Linux servers off direct AD joins to FreeIPA: cross-forest trust during transition, host-based access control and sudo rules, SSSD client changes, and when to cut the trust and run FreeIPA as the only Linux directory.
Windows Server core licenses and CALs for domain controllers against Samba on Linux: license savings, the Windows client CALs that may still apply for other servers, support, migration effort and the skills needed to run Samba DCs.
With Windows Server 2016 extended support ending in January 2027, the decision for each domain controller: upgrade to Windows Server 2025 and its licensing, move to Samba AD, or move Linux identity to FreeIPA, with timelines and risks.
Getting users, groups and attributes out of Active Directory with ldifde before a move to Samba AD, FreeIPA or OpenLDAP: export filters, omitting AD-only attributes, why passwords do not come with the export, and checking the result against the source.
A common search with a scope mismatch: Active Directory bundles directory, Kerberos, DNS and Group Policy for Windows, while OpenLDAP is an LDAP server. This page shows when OpenLDAP is enough, for Linux apps and LDAP-only services, and when Samba AD or FreeIPA is the real replacement.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.